Use separate PAT for Homebrew tap push

GITHUB_TOKEN lacks write access to nficano/homebrew-tap. Pass
TAP_GITHUB_TOKEN as a dedicated env var and reference it in the
GoReleaser brews config.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: nficano

.github/workflows/release.yml

@@ -73,4 +73,5 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
           RELEASE_NAME: ${{ steps.release-name.outputs.name }}

.goreleaser.yaml

@@ -59,6 +59,7 @@ brews:
   - repository:
       owner: nficano
       name: homebrew-tap
+      token: "{{ .Env.TAP_GITHUB_TOKEN }}"
     directory: Formula
     homepage: "https://github.com/nficano/github-runner"
     description: "Self-hosted GitHub Actions runner"